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Top Stories 

• A Moores ville, North Carolina fuel distribution company was the victim of an organized 
cyberheist in which thieves stole over $800,000 from the company’s payroll account. - 
Krebs on Security (See item 1) 

• DHS employees were notified of a vulnerability that may have led to personal information 
being accessible to unauthorized parties after a flaw was discovered on software used by a 
DHS vendor for processing personnel security investigations. - Help Net Security (See 
item 2 ^ 

• Firefighters reached 15 percent containment on a 6,000 acre wildfire burning in the 
Coronado National Forest near Nogales May 22. - United Press International (See item 

23 ) 

• Four school buses were involved in an accident near North Webster, Indiana, leaving over 
50 injured when one school bus ran into another causing a chain reaction crash. - 
Associated Press (See item 25) 
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Energy Sector 



1 . May 23, Krebs on Security - (North Carolina) NC fuel distributer hit by $800,000 
cyberheist. J.T. Alexander & Sons Inc., a Mooresville -based fuel distribution 
company, was the victim of an organized cyberheist in which thieves stole over 
$800,000 from the company’s payroll account. The criminals began the theft May 1 by 
sending money in sub-$5,000 and sub-$ 10,000 chunks to money mules via automated 
clearing house (ACH) transfers. 

Source: http://krebsonsecuritv.eom/2013/05/nc-fuel-distributor-hit-bv-800000- 
cyberheist/ 

2. May 22, U.S. Environmental Protection Agency - (Kansas) Coffeyville Resources 
Refining and Marketing to pay $300,000 to settle violations of Clean Air Act at 
Kansas oil refinery. Coffeyville Resources Refining & Marketing reached a settlement 
May 22 with the U.S. Environmental Protection Agency to perform a series of audits 
and reviews of their risk management procedures and their southeast Kansas facility as 
well as pay $300,000 in a civil penalty to address alleged violations of the Clean Air 
Act. The proposed settlement addresses issues of deficiencies in their risk management 
program. 

Source: 

http://vosemite.epa.gOv/opa/admpress.nsf/0/C991999B08F14CDB85257B730056A2B5 
For another story, see item 45 
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Chemical Industry Sector 

Nothing to report 
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Nuclear Reactors, Materials, and Waste Sector 

3. May 22, Associated Press - (South Carolina) Regulators: Minor tritium leak at SC 
nuclear plant. Water containing a small amount of tritium leaked from a pipe at the 
Catawba Nuclear Station in York County and was contained on site. The tritium levels 
were less than half the safe drinking water limit. 

Source: http://www.foxlOtv.com/dpp/news/national/Regulators-Minor-tritium-leak-at- 
SC-nuclear-plant 35901456 

[ Return to top] 



Critical Manufacturing Sector 

Nothing to report 
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Defense Industrial Base Sector 



Nothing to report 
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Financial Services Sector 

See item 1 
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Transportation Systems Sector 

4. May 23, Aspen Daily News - (Colorado) Deadly canyon crash sends motorists to 
still-closed pass. A fatal accident that left one dead when a vehicle collided with a 
truck closed a section of Interstate 70 in Glenwood Canyon for more than 8 hours. 
Source: http://www.aspendailvnews.com/section/home/158Q29 

5. May 23, WBNS 10 Columbus - (Ohio) 21-year-old killed in Licking Co crash, 1-70 
East reopened. A fatal accident that left one dead,\ occurred when a pickup truck and 
three tractor trailers crashed, prompting authorities to shut down eastbound lanes of 
Interstate 70 at State Route 310 in Licking County for over 7 hours. 

Source: http://www.I0tv.eom/content/stories/20I3/05/23/pataskala-fatal-accident-on-i- 
70.html 

6. May 22, KHON 2 Honolulu - (Hawaii) Owner of popular Oahu restaurant dies in 
Pali Highway crash. A crash that left one dead closed both directions of the Pali 
Highway in Honolulu for over 2 hours. 

Source: http://www.khon2.eom/2013/05/22/10670-autosave/ 

7. May 22, Salem Statesman Journal - (Oregon) Two injured in four-car collision on 
Highway 20. A four-vehicle collision injured two people on Highway 20 near Albany, 
Oregon; authorities spent 3 hours clearing the road. 

Source: http://www.statesmaniournal.eom/article/20130523/NEWS/305230061/Two- 
injured-four-car-collision-Highwav-20 

8. May 22, KTLA 5 Los Angeles - (California) 2 killed, 1 airlifted in big rig crash on 60 
Freeway. A box truck and big rig collided May 21 on a State Route 60 freeway 
transition lane in Pomona, killing two people and injuring another. The eastbound 
transition road was expected to remain closed for several hours as authorities conducted 
an investigation. 

Source: http://ktla.eom/2013/05/22/big-rig-crash-closes-portion-of-60-freewav-l- 
airlifted/#axzz2U 7 SxZzmD 
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9. May 22, WVEC 13 Hampton - (Virginia) Tractor- trailer accident causes backup on 
1-64. A tractor-trailer accident closed the left lanes of westbound Interstate 64 near 
Military Highway for several hours May 22. 

Source: http://www.wvec.com/news/local/Tracter-trailer-accident-shuts-down- 
westbound— 1-64— 208529821 .html 

10. May 22, United Press International - (Ohio) 34 injured in car-bus crash on Ohio 
highway. A bus collided with a car in the northbound lanes of Interstate 75 south of 
Bowling Green, injuring 34 people May 21. The lanes were shut down for 2 hours 
while authorities investigated. 

Source: http://www.upi.com/Top News/US/2013/05/22/34-injured-in-car-bus-crash- 
on-Ohio-highway/UPI-33061369255536/ 



For additional stories, see items 15, 16 , 25, and 44 
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Food and Agriculture Sector 

1 1 . May 22, Big Island Video News - (Hawaii) Hawaii cattle quarantined for Bovine 
Trichomoniasis. The Hawaii Department of Agriculture’s Animal Industry Division 
issued a quarantine order May 21 that requires testing of all beef and dairy bulls for a 
contagious reproductive disease called Bovine Trichomoniasis prior to entry into the 
State and before movement between herds within the State. 

Source: http://www.bigislandvideonews.eom/2013/05/22/hawaii-cattle-quaratined-for- 
bo vine-trichomoniasis/ 

12. May 22, Stateimpact Texas - (Texas) Quarantine in south Texas as Mexican Fruit 
Fly invades, again. Authorities in south Texas have quarantined an 85 square mile area 
in order to contain spotted larval Mexican Fruit Flies which could potentially threaten 
Texas agriculture. 

Source: http://stateimpact.npr.org/texas/2013/05/22/quarantine-in-south-texas-as- 
mexican-fruit-flv-invades-again/ 

13. May 22, Food Safety News - (National) Salmonella linked to Tahini sickens 8 across 
country. Imported tahini paste previously linked to 2 Salmonella illnesses in 
Minnesota the week of May 12 has now been connected to a nationwide Salmonella 
outbreak affecting at least 8 people. 

Source: http://www.foodsafetvnews.eom/2013/05/salmonella-linked-to-tahini-sickens- 
8-across-country/#.UZ4AD7Wkr44 

14. May 22, Food Safety News - (Nevada) Chorizo possible source of Las Vegas’s 
Firefly Salmonella outbreak. Epidemiologists believe that contaminated chorizo may 
be the source of a Salmonella outbreak linked to Las Vegas’s Firefly restaurant that is 
now known to have sickened at least 294 people. The Southern Nevada Health District 
announced May 22 the Salmonella outbreak strain was detected in a sample of cooked 
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chorizo collected from the restaurant. 

Source: http://www.foodsafetvnews.eom/2013/05/chorizo-likelv-source-of-las-vegas- 
fireflv-salmonella-outbreak/#.UZ3 ubWkr44 
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Water and Wastewater Systems Sector 

15. May 23, WPTV 5 West Palm Beach - (Florida) Water main break affects traffic in 
Port St. Lucie. A water main break near an elementary school in Port St. Lucie May 22 
prompted a closure of local roads near the school for several hours as city workers 
worked to repair the water main break. Affected roads were expected to remain closed 
into May 23. 

Source: http://www.wptv.com/dpp/news/region st lucie county/port st lucie/water- 
main-break-affects-bayshore-boulevard-traffic-in-port-st-lucie 

16. May 22, WTNH 8 New Haven - (Connecticut) Water main break to affect traffic in 
Middletown. A 12-inch water main break May 22 caused traffic delays in Middletown 
after the asphalt buckled from the heavy water flow beneath the street and prompted 
police to coordinate bus rerouting for three schools as city workers repaired the pipe 
and road. 

Source: http://www.wtnh.com/dpp/news/middlesex cty/water-main-break-to-affect- 
traffic-in-middletown#.UZ44YLWkq0g 

17. May 22, Madison County Journal - (Wisconsin) Main sewer line in danger of 
collapsing. Extensive repairs were determined to be needed to a major sewer line in 
Ridgeland shared by three water districts. The cost of repairs was estimated at about 
$150,000, according to a Ridgeland Public Works official. 

Source: 

http://onlinemadison.com/main.asp?SectionID=l&SubSectionID=l&ArticleID=26654 

18. May 21, KFOR 4 Oklahoma City- (Oklahoma) Power restored at Draper water 
treatment plant. Power was restored to the Draper Water Treatment Plant in 
Oklahoma City after May 20 storms caused an outage. 

Source: http://kfor.com/2Q 1 3/05/2 1/power-restored-at-draper- water-treatment- plant/ 
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Healthcare and Public Health Sector 



19. May 22, LaSalle News Tribune - (Illinois) Heritage Health fined for two resident 
neglect violations. Illinois Department of Public Health reported Heritage Health of 
Peru, Illinois, was fined $4,400 for numerous licensure violations involving two 
incidents of negligence that resulted in one resident’s death and another resident’s limb 
amputation. 

Source: 

http://newstrib.com/main.asp?SectionID=2&SubSectionID=27&ArticleID=29087 
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20. May 22, Charleston Post and Courier - (South Carolina) Clinic under investigation 
for hepatitis B cases says it will cooperate with health department. After 3 patients 
were diagnosed with aeute hepatitis B the South Carolina Department of Health and 
Environmental Control issued a public health order against Tri-County Spinal Care 
Center in north Charleston. The center is conducting a thorough investigation into their 
medical equipment while they are under a temporary order to stop performing all 
invasive procedures. 

Source: 

http://www.postandcourier.eom/article/20130522/PC16/130529795/1268/clinic-under- 

investigation-for-hepatitis-b-cases-says-it-will-cooperate-with-health-department 

For additional stories, see items 2^ and 44 
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Government Facilities Sector 

21. May 23, Help Net Security - (National) DHS employees’ info possibly compromised 
due to system flaw. DHS employees were notified of a vulnerability that may have led 
to personal information being accessible to unauthorized parties after a flaw was 
discovered on software used by a DHS vendor for processing personnel security 
investigations. DHS assured the public there was no evidence the information was 
mishandled and vendor is working with them to mitigate all damages. 

Source: http://www.net-securitv.org/secworld.php?id= 14953 

22. May 23, Associated Press - (Washington) FBI arrests suspect in Washington State 
ricin case. A man was arrested May 22 in connection with the discovery of a pair of 
letters containing ricin after a letter was mailed to a U.S. district judge in Spokane. The 
FBI is continuing to investigate and mitigate any remaining risks. 

Source: http://www.officer.com/news/10947854/fbi-arrests-suspect-in-washington- 
state-ricin-case 

23. May 22, United Press International - (Arizona) Nogales, Ariz., wildfire grows, only 
15 percent contained. Firefighters reached 15 percent containment on a wildfire 
burning in the Coronado National Forest near Nogales May 22. The wildfire has burned 
through 6,000 acres as over 200 personnel worked to halt its growth. 

Source: http://www.upi.com/Top News/US/2013/05/22/Nogales-Ariz-wildfire-grows- 
only- 1 5 -percent-contained/UPI- 18651369257733/ 

24. May 22, U.S. Forest Service - (California) Forest Service officials seek info on 
campground vandalisms. The U.S. Forest Service sent an alert asking for the public’s 
assistance in finding whoever caused $35,000 worth of damage at the Plumas National 
Forest Campgrounds at Fake Davis and Frenchman. Facilities were damaged through 
the removal of copper pipes and brass fixtures. 

Source: http://www.ktvn.com/storv/22398067/forest-service-officials-seek-info-on- 
campground-vandalisims 
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25. May 22, Associated Press - (Indiana) More than 50 injured in Indiana school hus 
crashes. Four school buses were involved in an aeeident near North Webster May 22, 
leaving over 50 injured when one sehool bus ran into another eausing a ehain reaetion 
crash. The accident is still under investigation as officials inspected the buses for any 
meehanical problems. 

Souree: 

http://www.hattiesburgamerican.eom/viewart/20130522/NEWS01/130522049/More- 
than-5 0-in j ured- Indiana- school-bus -erashes 

26. May 22, WCPO 9 Cincinnati - (Ohio) Wyoming High School reopened after bomb 
threat made. Students and staff were evaeuated for over 2 hours from Wyoming High 
School in Ohio after a bomb threat was called in May 22. Poliee conducted a seareh 
and gave the all-elear onee nothing suspicious was found. 

Source: 

http://www.wcpo.com/dpp/news/region central cincinnati/wyoming/W yoming-High- 
School-eleared-after-bomb-threat-made 



27. May 22, Pittsburgh Tribune-Review - (Pennsylvania) 2 Washington County high 
schools get bomb threats. Authorities evaeuated and dismissed elasses at Bentworth 
and California high schools in Washington County after they reeeived hoax bomb 
threats May 22. Police eonducted a seareh and did not find anything suspicious. 

Source: http://triblive.com/news/adminpage/4Q658 1 1 -74/bomb-calif omia- 
jackson#axzz2U2K5vipx 

28. May 22, Associated Press; KTVB 7 Boise - (Idaho) ISU to pay $400K after 
confidential medical records were exposed. Idaho State University (ISU) settled with 
the U.S. Department of Health and Human Serviees over eharges of improperly 
exposing eonfidential medical records in August 2011. ISU agreed to pay $400,000 
after an investigation determined that the Poeatello sehool did not adequately assess 
potential risks to medieal information shielded from release by the Health Insuranee 
Portability and Aeeountability Aet. 

Source: http://www.ktvb.eom/news/ISU-to-pav-400K-after-confidential-medieal- 
records-were-exposed-208522941.html 

29. May 21, Indianapolis Business Journal - (Indiana) Feds charge 5 in Indy Land Bank 
kickback scheme. Two Indianapolis city employees were charged along with three 
others in a scheme involving eash kickbacks on the sale of properties in the Indy Land 
Bank. 

Souree: http://www.ibj.com/feds-charge-5-in-indy-land-bank-kickback- 
scheme/P ARAMS/article/4 1468 



30. May 20, New York Times - (New York; International) 3 N.Y.U. scientists accepted 
bribes from China, U.S. says. Three New York University Sehool of Medieine 
researchers were charged in conneetion with eonspiring to take bribes from a Chinese 
medical imaging company and a Chinese-sponsored research institute to share 
nonpublie information about their work. The defendants, all Chinese eitizens, were 
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given support in the form of graduate school tuition, rental apartments, and travel 
expenses in exchange for information on research regarding M.R.I technology. 
Source: http://www.nvtimes.eom/2013/05/21/nvregion/us-savs-3-nvu-scientists-took- 
bribes-to-reveal-work-to-china.html? r=0 



For additional stories, see items 16 , and 36 
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Emergency Services Sector 

31. May 22, Associated Press; Elko Daily Free Press - (Nevada) Elko County jail 
warned about health violations. Health inspectors cited Elko County Jail in Nevada 
for several health code violations. While the jail works on repairing the deficiencies 
they temporarily transferred most inmates to other facilities. 

Source: http://www.mvnews4.com/news/storv/Elko-Countv-jail-warned-about-health- 
violations/Rw3kvQZ04UqPSkMmcgO IQ.cspx 
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Information Technology Sector 

32. May 23, Help Net Security - (International) Google researcher reveals another 
Windows 0-day. A researcher at Google found and reported a zero day vulnerability 
affecting Windows 7 and 8 that can allow privilege escalation and arbitrary code 
execution, though it is not remotely exploitable. 

Source: http://www.net-securitv.org/secworld.php?id= 14954 

33. May 22, The Register - (International) Twitter locks down logins by adding two- 
factor authentication. Twitter added an optional two-factor authentication service for 
users after recent account takeover attacks by hacktivists. 

Source: 

http://www.theregister.co.uk/2013/05/22/twitter adds two factor authentication/ 

34. May 22, Threatpost - (International) Another Max OS X backdoor reported. Another 
instance of OS X spyware known as OSX/KitM.A or OSX/Eilesteal was reported by 
German authorities. The spyware is signed by a valid Apple developer certificate that 
has since been revoked. 

Source: http://threatpost.com/another-mac-os-x-backdoor-reported/ 
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Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Weh site: https://www.it-isac.org 
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Communications Sector 

35. May 23, WWLP 22 Springfield- (Massachusetts) Temporary outage for T-Mobile 
customers. An undisclosed issue caused T-Mobile customers in the West Springfield 
area to experience problems with voice and messaging services May 22. 

Source: http://www.wwlp.com/dpp/news/massachusetts/temporarv-outage-for-t- 
mobile-customers 

36. May 21, KOAA 5 Colorado Springs - (Colorado) District wide phone outage 
reported for Pueblo City Schools. Pueblo City Schools reported a telephone outage 
May 21 after a contractor severed a line effecting incoming and outgoing calls from all 
district buildings. Officials encouraged teachers and parents to communicate via email 
until service was restored and posted a list of contacts for each school. 

Source: http://www.koaa.com/news/district-wide-phone-outage-reported-for-pueblo- 
city-schools/ 
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Commercial Facilities Sector 

37. May 23, Norwich Bulletin- (Connecticut) Large fire rips through Taftville 
apartment. A fire at an apartment building in Taftville left more than a dozen people 
displaced May 23. 

Source: http://www.norwichbulletin.eom/carousel/x914259300/Large-fire-rips- 
through-Taftville-apartment#axzz2U8FsK2oQ 

38. May 22, Associated Press - (California) Los Angeles buildings emptied after devices 
found. A police bomb squad evacuated three buildings and locked down several 
surrounding blocks in Los Angeles before detonating 17 homemade explosives devices 
in various stages found in an apartment after a traffic stop uncovered a weapon, 
narcotics, and an explosive liquid. The man allegedly responsible for the devices has no 
apparent link to terrorism but was booked on felony possession of a destructive device. 
Source: http://www.wthitv.com/dpp/news/national/LA-apartment-evacuated-bomb- 
squad-finds-devices 67199061 



39. May 22, WCVB 5 Boston- (Massachusetts) 200 evacuated as Lynn church goes up in 
flames. Firefighters battled a 3-alarm fire that broke out at a Lynn church May 21. 
About 200 people from a nearby apartment building were evacuated as a precaution. 
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Source: http://www.wcvb.com/news/local/boston-north/200-evacuated-as-lynn-church- 
goes-up-in-fIames/-/l 1984708/20250292/-/8b5khpz/-/index.html 



40. May 22, WSHV 3 Harrisonburg - (Virginia) Shopping center all clear after bomb 
scare. A Harrisonburg man was questioned after he approached a trooper outside a 
shopping center with a “WWII era” mortar round which prompted an area lockdown to 
investigate the device. 

Source: http://www.whsv.eom/news/headlines/Shopping-Center-All-Clear-after-Bomb- 
Scare-208557261.html 

41. May 22, WDRB 41 Louisville - (Kentucky) Police: 14 vehicles stolen from Louisville 
International Airport. Louisville Metro Police arrested two AVIS car rental service 
employees after they allegedly stole 14 vehicles and were part of a car theft ring where 
they rented stolen cars and falsified computer records to hide the crime. 

Source: http://www.wdrb.com/storv/22387926/police-14-vehicles-stolen-from- 
louisville-intemational-airport 

42. May 21, WRAL 5 Raleigh- (North Carolina) Lightning strike causes Raleigh 
apartment fire. 19 people were displaced from a Raleigh apartment complex fire 
ignited by lightning. 

Source: http://www.wral.com/lightning-strike-causes-raleigh-apartment-fire/1247Q927/ 
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Dams Sector 

43. May 22, Ottawa Times- (Illinois) Marseilles flood risk 20 times greater. U.S. Army 
Corps of Engineers officials provided flood risk assessments for the city of Marseilles, 
Illinois, following April storms and damage to its dam gates during planned repairs to 
the structures. Temporary repairs to the gates are estimated to cost $10 million and will 
reduce the threat of flooding significantly as gates are repaired; permanent repairs are 
estimated to cost $50 million. 

Source: http://mvwebtimes.com/archives/ottawa/displav.php?id=475977 

44. May 22, Associated Press- (North Dakota) Flooding forces evacuation of 1,300 in 
ND town. A number of evacuations occurred throughout Pembina County towns as 
flooding threatened the Renwick Dam’s capacity. Evacuations included healthcare 
facilities, and the flooding also prompted the closure of portions of Highway 5 and 
Highway 18. 

Source: http://nation.time.eom/2013/05/22/flooding-forces-evacuation-of-1300-in-nd- 
town/ 

45. May 21, Charlotte Observer - (North Carolina) Duke says flood gate at dam failed. 
Duke Energy responded to the Federal Energy Regulation Commission’s request to 
explain how its Oxford Dam on Fake Hickory failed to fully open during flooding May 
5, by announcing a hoist on the dam that lifts gates failed because of an electrical 
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problem. Crews were able to repair the problem in roughly 3 hours, but excess water 
still poured over the dam’s emergency spillway in the meantime flooding about 90 
homes. 

Source: http://www.charlotteobserver.eom/2013/05/21/4055034/duke-savs-flood-gate- 
at-dam-failed.html 
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V III ..! 1. I- If I , •..I', o. I , Ni-i. I . 

NO ACTIVE ALERTS 
\v ww.DHS.gov /alerts 
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summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailvReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support® govdeliverv.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 
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